Use Or Abuse Of A Data Access Request?

Author:Ms Yvonne Cunnane and John O'Connor
Profession:Matheson Ormsby Prentice

The High Court recently dismissed an appeal by Dublin Bus in relation to an enforcement order issued by the Data Protection Commissioner on the basis that the existence of legal proceedings between a data controller and a data subject does not preclude the data subject from submitting a data access request even if such request is being used as an alternative or supplement to discovery. The High Court upheld the enforcement notice issued by the Data Protection Commissioner requiring Dublin Bus to provide a copy of CCTV footage to the data subject.

The decision highlights the fact that data controllers must comply with data access requests notwithstanding that data subjects may be using such requests as a shortcut for accessing documentation in the context of ongoing legal proceedings. There is no statutory exemption available to data controllers to complying with a data access request where there are separate legal proceedings in play and the request is being used by the data subject to further such proceedings.


An individual has a right of access to personal data held about them by a data controller pursuant to section 4(1)(a) of the Data Protection Acts 1988 and 2003 (DPA). Having initiated personal injury proceedings against Dublin Bus, the data subject subsequently submitted a data subject access request to Dublin Bus seeking a copy of her personal data, including CCTV footage of the incident. This request was declined by Dublin Bus initially on the grounds that the information requested was privileged (legal privilege being one of the exemptions from compliance with data access requests under the DPA). The data subject complained to the Data Protection Commissioner and an enforcement notice was issued by the Commissioner requiring Dublin Bus to provide the CCTV footage.

Dublin Bus relied on English case-law to support the argument that there is an exception to the right of access where there are legal proceedings ongoing between the data subject and the data controller. Dublin Bus argued that the fact that the Commissioner had notice that proceedings had commenced between the parties required the Commissioner to advise the data subject that she should proceed by way of an order for discovery not a data access request. Dublin Bus submitted that the courts are the sole body with competence to order discovery of documents and that competence should not be usurped by the Data Protection Commissioner.


The High Court, in...

To continue reading